11

While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check XSS (From RSnake's XSS cheat sheet):

'';!--"<XSS>=&{()}

and verified the source for <XSS verses &lt;XSS to see if it is vulnerable. I got <XSSin the source which suggests that this field is vulnerable to cross site scripting.

Now I am trying to create some code which should be less or equal to 20 characters and could be executed on this field to confirm the XSS but I am finding it hard. So in this case I have basically two questions:

1: Can someone help with such piece of code?

2: To mitigate XSS, validation for max-length(15-20 characters) could be one of the options other than the combination of data validation + HTML encoding? Please assume business rules agrees with the 15-20 characters limit.

Hope I was able to explain the question and the scenario. Kindly let me know in case of any doubts.

Improve this question
9
  • 1
    Got the executable code. <a href=a.by>
    – p_upadhyay
    Commented Jun 14, 2011 at 7:13
  • 3
    Not exactly answer to your question, but interesting tips how to shorten JavaScript code can be found here: github.com/jed/140bytes/wiki/Byte-saving-techniques
    – bretik
    Commented Jun 14, 2011 at 7:48
  • 2
    why did you delete most of the text of the question? it was fine as it was (just no need to copy the answers, just mark it as accepted...)
    – AviD ♦
    Commented Jun 14, 2011 at 9:43
  • 1
    @P_upadhyay: Please remove the answers from your question. If there is not an answer given that is correct, add an answer yourself and mark it as correct, but don't edit questions to add the answers. See my note on edit #4 for why I removed them once already.
    – Caleb
    Commented Jun 17, 2011 at 15:35
  • 2
    @p_upadhyay: You don't need extra reputation to do the things you need to do to handle your own questions properly. First of all, you should mark Ori's answer as correct. You state in your edit you got at least part of your right answer from him, so check his answer as correct. If the extra examples are useful, you can add another answer yourself. You will be prompted about "are you sure you want to answer your own question", but you can go ahead and add an answer.
    – Caleb
    Commented Jun 20, 2011 at 10:07

3 Answers 3

Reset to default
9

I love irony. Here's the line that was going to be my response. And the error I received for posting it.

<script src=//h4k.me

Oops! Your answer couldn't be submitted because:

body must be at least 30 characters; you entered 20

Use variable recasting if at all possible before processing input (if not, regex to throw <'s /s etc out.)

Improve this answer
1
  • I don't think that's irony ;)
    – AviD ♦
    Commented Jun 14, 2011 at 7:24
5

Other then the script provided by Ori, there are a few other scripts which could be useful in this case:-

<a href=http://a.by>
<a onclick=alert(2)>
<b onclick=alert(2)>
Improve this answer
0

The shortest XSS payload that I have ever seen that opens an alert dialog and does not require user interaction is the following:

<svg/onload=alert()>

However, if the only requirement is that it must be usable for XSS vulnerability testing, this is the shortest it can get:

<

You'd just have to view the page source to see if it writes < or &#x3C; to the page, so it isn't as fast

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .